Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Amazing example. Blindly doing anything because of Valgrind is bad, but I think a better rule might be "Don't comment out lines you don't understand in a standard cryptography package and then distribute it to users without warning". I don't think a mere "mention of the need for caution" could have saved anyone here. Handcuffs and a straightjacket on the Debian developer might have been required in this case.

This link covers it well:

  What can we learn from this? Firstly, vendors should not be 
  fixing problems (or, really, anything) in open source 
  packages by patching them locally – they should contribute 
  their patches upstream to the package maintainers. Had 
  Debian done this in this case, we (the OpenSSL Team) would 
  have fallen about laughing, and once we had got our breath 
  back, told them what a terrible idea this was. But no, it 
  seems that every vendor wants to “add value” by getting in 
  between the user of the software and its author.

  Secondly, if you are going to fix bugs, then you should 
  install this maxim of mine firmly in your head: never fix a 
  bug you don’t understand. I’m not sure I’ve ever put that 
  in writing before, but anyone who’s worked with me will 
  have heard me say it multiple times.
http://www.links.org/?p=327


"...we (the OpenSSL Team) would have fallen about laughing..."

Note this attitude of derision and arrogance. It's interesting that this was before the quality of OpenSSL code became common knowledge, heartbleed and finally the major work of LibreSSL. I'm not sure if I'd just really like this kind attitude to be a good indicator of trouble coming or it really is so.

Anyway be excellent to each other!


From my memory, the Debian developer did email upstream regarding it - and never got a reply...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: